system-design-overview

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). The list includes direct raw script URLs (raw.githubusercontent.com/cursor-setup.sh) and README instructions that suggest running curl | bash, cloud metadata endpoints (169.254.169.254) and internal service hostnames (kubernetes.default.svc, localhost, token.actions.githubusercontent.com) as well as an explicit "attacker" host — combined these are high-risk indicators for malware distribution, SSRF/exfiltration, and credential theft.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The README recommends running a runtime install command that fetches and executes remote code via curl: "curl -sSL https://raw.githubusercontent.com/truongnat/system-design-skills/main/cursor-setup.sh | bash", which downloads and runs a remote script (remote code execution) as part of the skill setup.